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Why GAO Did This Study 

The Visa Waiver Program (VWP) 
allows eligible nationals from 36 
member countries to travel to the 
United States for tourism or business 
for 90 days or less without a visa. In 
2007, Congress required the Secretary 
of Homeland Security, in consultation 
with the Secretary of State, to 
implement an automated electronic 
travel authorization system to 
determine, prior to travel, applicants' 
eligibility to travel to the United 
States under the VWP. Congress also 
required all VWP member countries 
to enter into an agreement with the 
United States to share information on 
whether citizens and nationals of that 
country traveling to the United States 
represent a security threat. In 2002, 
Congress mandated that the 
Department of Homeland Security 
(DHS) review, at least every 2 years, 
the security risks posed by each VWP 
country's participation in the 
program. In this report, GAO 
evaluates (1) DHS's implementation 
of an electronic system for travel 
authorization; (2) U.S. agencies' 
progress in negotiating information- 
sharing agreements; and (3) DHS's 
timeliness in issuing biennial reports. 
GAO reviewed relevant documents 
and interviewed U.S., foreign 
government, and travel industry 
officials in six VWP countries. 

What GAO Recommends 

GAO recommends that DHS establish 
time frames for the regular review of 
cases of ESTA noncompliance and 
take steps to address delays in the 
biennial review process. DHS 
concurred with the report's 
recommendations. 
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What GAO Found 

DHS has implemented the Electronic System for Travel Authorization (ESTA) 
and has taken steps to minimize the burden associated with the new program 
requirement. However, DHS has not fully evaluated security risks related to 
the small percentage of VWP travelers without verified ESTA approval. DHS 
requires applicants for VWP travel to submit biographical information and 
answers to eligibility questions through ESTA prior to travel. Travelers whose 
ESTA applications are denied can apply for a U.S. visa. In developing and 
implementing ESTA, DHS has made efforts to minimize the burden imposed 
by the new requirement. For example, although travelers formerly filled out a 
VWP application form for each journey to the United States, ESTA approval is 
generally valid for 2 years. Most travel industry officials GAO interviewed in 
six VWP countries praised DHS's widespread ESTA outreach efforts, 
reasonable implementation time frames, and responsiveness to feedback, but 
expressed dissatisfaction with the costs associated with ESTA. In 2010, 
airlines complied with the requirement to verify ESTA approval for almost 98 
percent of VWP passengers prior to boarding, but the remaining 2 percent — 
about 364,000 travelers — traveled under the VWP without verified ESTA 
approval. DHS has not yet completed a review of these cases to know to what 
extent they pose a risk to the program. 

To meet the legislative requirement, DHS requires that VWP countries enter 
into three information-sharing agreements with the United States; however, 
only half of the countries have fully complied with this requirement and many 
of the signed agreements have not been implemented. Half of the countries 
have entered into agreements to share watchlist information about known or 
suspected terrorists and to provide access to biographical, biometric, and 
criminal history data. By contrast, almost all of the 36 VWP countries have 
entered into an agreement to report lost and stolen passports. DHS, with the 
support of interagency partners, has established a compliance schedule 
requiring the last of the VWP countries to finalize these agreements by June 
2012. Although termination from the VWP is one potential consequence for 
countries not complying with the information-sharing agreement requirement, 
U.S. officials have described it as undesirable. DHS, in coordination with 
State and Justice, has developed measures short of termination that could be 
applied to countries not meeting their compliance date. 

DHS has not completed half of the most recent biennial reports on VWP 
countries' security risks in a timely manner. According to officials, DHS 
assesses, among other things, counterterrorism capabilities and immigration 
programs. However, DHS has not completed the latest biennial reports for 18 
of the 36 VWP countries in a timely manner, and over half of these reports are 
more than 1 year overdue. Further, in the case of two countries, DHS was 
unable to demonstrate that it had completed reports in the last 4 years. DHS 
cited a number of reasons for the reporting delays. For example, DHS officials 
said that they intentionally delayed report completion because they frequently 
did not receive mandated intelligence assessments in a timely manner and 
needed to review these before completing VWP country biennial reports. 
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United States Senate 

In 2010, more than 17 million foreign nationals from 36 participating 
countries entered the United States for tourism or business for 90 days or 
less under the Visa Waiver Program (VWP). Congress established the 
program in 1986 to facilitate international travel without threatening U.S. 
security. The Implementing Recommendations of the 9/11 Commission Act 
of 2007 (9/11 Act) called for the Department of Homeland Security (DHS), 
which implements the program, to take steps to enhance the security of 
the VWP. 1 Among the mandated changes were (1) the implementation of 
an electronic system for travel authorization designed to determine in 
advance of travel the eligibility of VWP applicants to travel to the United 
States under the program, (2) a requirement that all VWP countries enter 
into agreements to share information with the United States on whether 
citizens and nationals of that country traveling under the program 
represent a threat to the security or welfare of the United States, and (3) a 
requirement that all VWP countries enter into agreements with the United 
States to report or make available lost and stolen passport data to the 
United States. Prior to these changes, Congress also mandated in 2002 that 
DHS evaluate and report on the security risks posed by each visa waiver 
country's participation in the program at least once every 2 years. In 2006, 
GAO identified deficiencies in DHS's biennial reporting process and 
recommended the finalization of protocols that included deadlines for 
report completion. 2 

VWP travelers are not subject to the same degree of screening as those 
with visas because they are not interviewed by a Department of State 
(State) consular officer before arriving at a U.S. port of entry. As a result, 



^ub. L. No. 110-53 (Aug. 3, 2007). 

2 See GAO, Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the 
Visa Waiver Program, GAO-06-854 (Washington, D.C.: July 28, 2006). 
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concerns have been raised that the VWP could be exploited to gain illegal 
entry into the United States. Effective oversight of the VWP is essential to 
find the right balance between facilitating legitimate travel and screening 
for potential terrorists, criminals, and others that may pose national 
security, law enforcement, or immigration concerns. 

In response to your request, this report (1) reviews DHS's implementation 
of the Electronic System for Travel Authorization (ESTA); (2) assesses 
U.S. agencies' progress in negotiating the required information-sharing 
agreements with VWP countries; and (3) assesses the timeliness of DHS's 
biennial reports on VWP countries. 

To assess the implementation of ESTA, we reviewed relevant 
documentation, including 2006 and 2008 GAO reports evaluating the VWP 
and statistics on program applicants and travelers. 3 We also interviewed 
consular, public diplomacy, and law enforcement officials at U.S. 
embassies in six VWP countries: France, Ireland, Japan, South Korea, 
Spain, and the United Kingdom. We met with political and commercial 
officers at five of the six U.S. embassies. In the six countries, we also met 
with airline officials and travel industry officials regarding ESTA 
implementation. While the results of our site visits are not generalizable, 
they provided perspectives on VWP and ESTA implementation. To assess 
DHS's progress in meeting information-sharing agreement requirements, 
we reviewed the templates used to begin negotiations for information- 
sharing agreements and lists of countries that have met the requirement to 
enter into information-sharing agreements with the United States. We 
interviewed officials from DHS, State, and the Department of Justice 
(Justice) at headquarters and at U.S. embassies in six VWP countries who 
have participated in negotiating or implementing information-sharing 
agreements with VWP countries. We also interviewed foreign government 
officials from agencies responsible for negotiating information-sharing 
agreements with the U.S. government and International Criminal Police 
Organization (Interpol) officials in Lyon, France, who receive the 
information on lost and stolen passports from VWP country governments. 
To assess the timeliness of biennial reports on VWP countries, we 
reviewed documentation of DHS biennial report completion and DHS's 
standard operating procedures for conducting biennial reviews. 



3 See GAO, Visa Waiver Program: Actions Are Needed to Improve Management of the 
Expansion Process, and to Assess and Mitigate Program Risks, GAO-08-967 (Washington, 
D.C.: Sept. 15, 2008). 
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We conducted this performance audit from January 2010 to May 2011, in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

We received written comments from DHS, which we have reprinted in 
appendix III. We also received technical comments from DHS, State, and 
Justice and incorporated those comments, as appropriate. DHS agreed 
with our recommendations and stated that it is undertaking and 
considering efforts to address them. DHS provided additional information 
on its efforts to monitor and assess issues that may pose a risk to U.S. 
interests. 



Background 



Legislation Authorizing the The Immigration Reform and Control Act of 1986 created the VWP as a 
VWP pilot program, 4 and the Visa Waiver Permanent Program Act permanently 

established the program in October 2000. 5 The program's purpose is to 
facilitate the legitimate travel of visitors for business or tourism. By 
providing visa-free travel to the United States, the program is intended to 
boost international business and tourism, as well as airline revenues, and 
create substantial economic benefits to the United States. Moreover, the 
program allows State to allocate more resources to visa-issuing posts in 
countries with higher risk applicant pools. 

In November 2002, Congress passed the Homeland Security Act of 2002, 
which established DHS and gave it responsibility for establishing visa 
policy, including policy for the VWP. 6 Previously, Justice had overall 
responsibility for managing the program. In July 2004, DHS created the 
Visa Waiver Program Oversight Unit within the Office of International 
Enforcement and directed that unit to oversee VWP activities and monitor 



4 Pub. L. No. 99-603 (Nov. 6, 1986). 
5 Pub. L. No. 106-396 (Oct. 30, 2000). 
6 Pub. L. No. 107-296 (Nov. 25, 2002). 
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participating VWP countries' adherence to the program's statutory and 
policy requirements. In September 2007, the office was renamed the Visa 
Waiver Program Office. To help fulfill its responsibilities, DHS established 
an interagency working group comprising representatives from State, 
Justice, and several DHS component agencies and offices, including U.S. 
Customs and Border Protection (CBP) and U.S. Immigration and Customs 
Enforcement. 

Since the attacks on the United States on September 11, 2001, Congress 
has passed several other laws to strengthen border security policies and 
procedures. For example, the Enhanced Border Security and Visa Entry 
Reform Act of 2002 7 increased the frequency — from once every 5 years to 
at least once every 2 years — of mandated assessments of the effect of each 
country's continued participation in the VWP on U.S. security, law 
enforcement, and immigration interests. 8 The 9/11 Act also added security 
requirements for all VWP countries, such as the requirement that countries 
enter into an agreement with the United States to share information on 
whether citizens and nationals of that country traveling to the United 
States represent a threat to the security or welfare of the United States or 
U.S. citizens. 



VWP Member Countries When the Visa Waiver Pilot Program was established in 1986, participation 

was limited to eight countries. Since then, the VWP has expanded to 36 
countries. 9 Figure 1 shows the locations of the current member countries. 



7 Pub. L. No. 107-173 (May 14, 2002). 

8 The Visa Waiver Permanent Program Act mandated that the U.S. government conduct 
VWP country reviews at least every 5 years. 

9 The Immigration Act of 1990 (Pub. L. No. 101-649) removed the limit on the number of 
countries that could participate in the program. 
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Figure 1 : Visa Waiver Program Member Countries 
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VWP Requirements 



To qualify for the VWP a country must 



• offer reciprocal visa-free travel privileges to U.S. citizens; 

• have had a refusal rate of less than 3 percent for the previous fiscal year 
for its nationals who apply for business and tourism visas; 

• issue machine-readable passports to its citizens; 

• enter into an agreement with the United States to report or make available 
through Interpol or other means as designated by the Secretary of 
Homeland Security information about the theft or loss of passports; 

• accept the repatriation of any citizen, former citizen, or national against 
whom a final order of removal is issued no later than 3 weeks after the 
order is issued; 

• enter into an agreement with the United States to share information 
regarding whether citizens and nationals of that country traveling to the 
United States represents a threat to U.S. security or welfare; and 

• be determined not to compromise the law enforcement (including 
immigration enforcement) or security interests of the United States by its 
inclusion in the program. 



In addition, all passports issued after October 26, 2005, must contain a 
digital photograph in the document for travel to the United States under 
the program, and passports issued after October 26, 2006, must be 
e-passports that are tamper-resistant and incorporate a biometric 
identifier. 10 Nationals from countries that have joined the VWP since 2008 
must use e-passports in order to travel under the VWP. Effective July 1, 
2009, all emergency or temporary passports must be e-passports as well 
for use under the VWP. 



In general, e-passports contain a chip embedded in the passport that stores the same 
information that is printed on the data page of the passport, such as the name, date of birth, 
gender, place of birth, dates of passport issuance and expiration, place of issuance, 
passport number, and a photo image of the bearer. In addition, e-passports hold a unique 
identification number and a digital signature to protect the stored data from alteration. 
E-passports provide two key pieces of information: the digital signature and the digital 
image of the passport holder. Digital signatures provide a higher level of security for the 
passport by providing a means to electronically verify the authenticity of the data on the 
chip, including the traveler's photograph and biographical information. 
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To be eligible to travel without a visa under the program, nationals of VWP 
countries must 

• have received an authorization to travel under the VWP through ESTA; 

• have a valid passport issued by the participating country and be a national 
of that country; 

• seek entry for 90 days or less as a temporary visitor for business or 
tourism; 

• have been determined by CBP at the U.S. port of entry to represent no 
threat to the welfare, health, safety, or security of the United States; 

• have complied with conditions of any previous admission under the 
program (for example, individuals must not have overstayed the 90-day 
limit during prior visits under the VWP); 

• if entering by air or sea, possess a return trip ticket to any foreign 
destination issued by a carrier that has signed an agreement with the U.S. 
government to participate in the program, and must have arrived in the 
United States aboard such a carrier; and 

• if entering by land, have proof of financial solvency and a domicile abroad 
to which they intend to return. 

Travelers who do not meet these requirements are required to obtain a 
visa from a U.S. embassy or consulate overseas before traveling to the 
United States. Unlike visa holders, VWP travelers generally may not apply 
for a change in status or an extension of the allowed period of stay. 
Individuals who have been refused admission to the United States 
previously must also apply for a visa. VWP travelers waive their right to 
review or appeal a CBP officer's decision regarding their admissibility at 
the port of entry or to contest any action for removal, other than on the 
basis of an application for asylum. 
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DHS Implemented 
ESTA to Meet 
Mandated 

Requirement but Has 
Not Fully Analyzed 
Risks from 
Noncompliance 



DHS has implemented ESTA to meet the 9/11 Act requirement intended to 
enhance program security and has taken steps to minimize the burden on 
travelers to the United States added by the new requirement, but it has not 
fully analyzed the risks of carrier and passenger noncompliance with the 
requirement. DHS developed ESTA to collect passenger data and complete 
security checks on the data before passengers board a U.S. bound carrier. 
In developing and implementing ESTA, DHS took several steps to 
minimize the burden associated with ESTA use. For example, ESTA 
reduced the requirement that passengers provide biographical information 
to DHS officials from every trip to once every 2 years. In addition, because 
of ESTA, DHS has informed passengers who do not qualify for VWP travel 
that they need to apply for a visa before they travel to the United States. 
Moreover, most travel industry officials we interviewed in six VWP 
countries praised DHS's widespread ESTA outreach efforts, reasonable 
implementation time frames, and responsiveness to feedback but 
expressed dissatisfaction over ESTA fees. Also, although carriers complied 
with the ESTA requirement to verify ESTA approval for almost 98 percent 
of VWP passengers before boarding them in 2010, DHS does not have a 
target completion date for a review to identify potential security risks 
associated with the small percentage of cases of traveler and carrier 
noncompliance with the ESTA requirement. 



DHS Implemented ESTA to 
Meet Congressional 
Requirement and Use Rose 
Rapidly After DHS Made It 
Mandatory 

DHS Implemented ESTA to Pursuant to the 9/11 Act, DHS implemented ESTA, an automated, Web- 

Assist with Preboarding Checks based system, to assist in assessing passengers' eligibility to travel to the 
of Passenger Data United States under the VWP by air or sea before they board a U.S. bound 

carrier. 11 DHS announced ESTA as a new requirement for travelers 
entering the United States under the VWP on June 9, 2008, and began 
accepting ESTA applications on a voluntary basis in August 2008. 
Beginning January 12, 2009, DHS required all VWP travelers to apply for 
ESTA approval prior to travel to the United States. DHS began enforcing 



In addition to ESTA, Secure Flight and the Advanced Passenger Information System also 
provide data on passengers that DHS uses to determine whether any passenger poses a 
security risk. 
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compliance with ESTA requirements in March 2010, exercising the right to 
fine a carrier or rescind its VWP signatory status for failure to comply with 
the ESTA requirement. Although passengers may apply for ESTA approval 
anytime before they board a plane or ship bound for the United States, 
DHS recommends that travelers apply when they begin preparing travel 
plans. 12 Prior to ESTA's implementation, all travelers from VWP countries 
manually completed a form — the I-94W — en route to the United States, 
supplying biographical information and answering questions to determine 
eligibility for the VWP. DHS officials collected the forms from VWP 
passengers at U.S. ports of entry and used the information on the forms to 
qualify or disqualify the passengers for entry into the United States 
without a visa. 

DHS uses ESTA to electronically collect VWP applicants' biographical 
information and responses to eligibility questions. The ESTA application 
requires the same information collected through the I-94W forms. When an 
applicant submits an ESTA application, DHS systems evaluate the 
applicant's biographical information and responses to VWP eligibility 
questions. (See table 1.) If the DHS evaluation results in a denial of the 
application, the applicant is directed to apply for a U.S. visa. 13 For all other 
applications, if this review process locates no information requiring 
further analysis, DHS notifies the applicant that the application is 
approved; 14 if the process locates such information, DHS notifies the 
applicant that the application is pending, and DHS performs a manual 
check on the information. For example, if an applicant reports that a 



Although DHS officials said that most applicants receive notification of ESTA approval or 
denial within seconds of submitting the online application, DHS reserves the right to do 
manual checks that may take up to 72 hours before making a final decision on an ESTA 
application. 

13 A denied ESTA application means the applicant may not travel to the United States under 
the VWP. Travel to the United States is still possible if the applicant successfully applies 
for and obtains a visa for travel. State consular officers at five of the six U.S. embassies we 
visited in VWP countries said that people whose ESTA applications are denied frequently 
obtain a visa to travel to the United States after undergoing a full visa interview by a 
consular officer. State officials said they did not maintain statistics on how many visa 
applicants had been denied an ESTA or how many applicants who had been denied an 
ESTA were successful in obtaining a visa to visit the United States. Consular officers in the 
countries we visited said that they interviewed visa applicants every week who had been 
denied an ESTA. 

14 ESTA approval does not guarantee an applicant the right to enter the United States. It 
means that the applicant can board a U.S. bound airplane or ship without a visa if the 
passport presented at the port of departure matches the information provided in the 
approved ESTA application. 
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previous U.S. visa application was denied, DHS deems the ESTA 
application pending and performs additional review. If on further review 
of any pending application DHS determines that information disqualifies 
the applicant from VWP travel, the application is denied, and the individual 
is directed to apply for a visa; otherwise the applicant is approved. 



Table 1 : Visa Waiver Program Eligibility Questions in the ESTA Application 



a) Do you have a communicable disease; physical or mental disorder; or are you a drug abuser or addict? 

b) Have you ever been arrested or convicted for an offense or crime involving moral turpitude or a violation related to a controlled 
substance; or have been arrested or convicted for two or more offenses for which the aggregate sentence to confinement was five 
years or more; or have been a controlled substance trafficker; or are you seeking entry to engage in criminal or immoral activities? 

c) Have you ever been or are you now involved in espionage or sabotage; or in terrorist activities; or genocide; or between 1933 and 
1945 were you involved, in any way, in persecutions associated with Nazi Germany or its allies? 

d) Are you seeking to work in the U.S.; or have you ever been excluded and deported; or been previously removed from the United 
States or procured or attempted to procure a visa or entry into the U.S. by fraud or misrepresentation? 

e) Have you ever detained, retained or withheld custody of a child from a U.S. citizen granted custody of the child? 

f) Have you ever been denied a U.S. visa or entry into the U.S. or had a U.S. visa canceled? 

g) Have you ever asserted immunity from prosecution? 

Source: DHS Electronic System for Travel Authorization application. 

Note: This table is a direct download from the DHS application with no changes. 

Figure 2 illustrates the ESTA application review process. (See app. II for 
information on how to apply for ESTA.) 
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Figure 2: DHS Process for ESTA Application Review 
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Source: GAO analysis of DHS data. 

"When an application is denied, the response from DHS directs the applicant to State's Web site for 
information about applying for a visa. 
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ESTA Use Rose Rapidly Once According to DHS data, the number of individuals submitting ESTA 
Mandatory; DHS Has Approved applications increased from about 180,000 per month in 2008, when 
Most ESTA Applications but applying was voluntary, to more than 1.15 million per month in 2009 and 
Deemed Thousands Ineligible 2010 after DHS made ESTA mandatory. DHS approved over 99 percent of 

the almost 28.6 million ESTA applications submitted from August 2008 
through December 2010, but it also denied the applications of thousands 
of individuals it deemed ineligible to travel to the United States under the 
VWP. The denial rate has decreased slightly from 0.42 percent in 2008 to 
0.24 percent in 2010. (See fig. 3.) 



Figure 3: ESTA Applications Approved and Denied, 2008-2010 
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DHS data show that DHS denied 77,132 of the almost 28.6 million 
applications for VWP travel submitted through ESTA from 2008 through 
2010. Reasons for denials included applicants' responses to the eligibility 
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questions, as well as DHS's discovery of other information that disqualified 
applicants from travel under the VWP. Examples are as follows: 

• DHS denied 19,871 applications because of applicant responses to the 
eligibility questions. 

• DHS denied 36,744 pending applications because of the results of manual 
reviews of passenger data. 

• DHS denied 15,078 applications because the applicants had unresolved 
cases of a lost or stolen passport that DHS decided warranted an in-person 
visa interview with a State consular officer. 

In addition, ESTA applications are regularly reevaluated as new 
information becomes available to DHS, potentially changing applicants' 
ESTA status. 



In developing and implementing ESTA, DHS has taken steps to minimize 
the burden associated with ESTA's use. 

Less frequent applications. ESTA approval for program participants 
generally remains valid for 2 years. Prior to ESTA implementation, 
passengers traveling under the program were required to complete the I- 
94W form to determine their program eligibility each time they boarded a 
carrier to the United States. When DHS implemented ESTA, the burden on 
passengers increased because DHS also required ESTA applicants to 
complete an I-94W form. However, on June 29, 2010, DHS eliminated the I- 
94W requirement for most air and sea travelers who had been approved by 
ESTA. According to travel industry officials in the six VWP countries we 
visited, this change has simplified travel for many travelers, especially 
business travelers who travel several times each year. DHS officials said 
the change also eliminated the problems of deciphering sometimes 
illegible handwriting on the I-94W forms. 

• Earlier notice of ineligibility. ESTA notifies passengers of program 
ineligibility, and therefore of the need to apply for a visa, before they 
embark for the United States. Prior to ESTA implementation, passengers 
from VWP countries did not learn until reaching the U.S. port of entry 
whether they were eligible to enter under the VWP or would be required to 
obtain a visa. Because DHS received passengers' completed I-94W forms at 
the port of entry, DHS officials did not recommend that carriers prevent 
passengers from VWP countries from boarding a U.S. bound carrier 



DHS Made Efforts to 
Minimize Burden of ESTA 
Requirement 
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without a visa unless they were deemed ineligible based on other limited 
preboarding information provided by carriers. 

• Widespread U.S. government outreach. VWP country government and 
travel industry officials praised widespread U.S. government efforts to 
provide information about the ESTA requirements. 15 After announcing 
ESTA, DHS began an outreach campaign in VWP countries and for foreign 
government embassy staff in the United States, with the assistance of 
other U.S. agencies, to publicize the requirement. DHS officials said they 
spent $4.5 million on ESTA outreach efforts. Although none of the six 
embassies we visited tracked the costs associated with outreach, each 
embassy provided documentation of their use of many types of outreach 
efforts listed in table 2. VWP country government officials and travel 
industry officials we met said that although they were initially concerned 
that ESTA implementation would be difficult and negatively affect airlines 
and many VWP passengers, implementation went more smoothly than 
expected. 



Table 2: U.S. Government Outreach Efforts Undertaken to Publicize ESTA 


Outreach effort 


Target audience 


Where used (examples) 


ESTA ads 


General public, travel industry officials 


U.S. embassy Web sites, travel industry 
publications, national newspapers, YouTube™ 


Informational and promotional 
materials 


General public, travel industry officials 


U.S. embassies, airports, travel agencies, travel 
industry events 


Conferences and media events 


General public, travel industry officials 


U.S. embassies, airports, travel industry events 


Outreach to U.S. and foreign 
government officials 


U.S. embassy officials, foreign government 
officials 


U.S. embassies, embassy day events 



Sources: DHS and State officials. 



• Reasonable implementation timeframes. Most of the VWP country airline 
officials with whom we met said that the ESTA implementation time 
frames set by DHS were reasonable. In 2008, DHS introduced ESTA and 
made compliance voluntary. The following year, DHS made ESTA 
mandatory but did not levy fines if airlines did not verify passengers' ESTA 
approval before boarding them. This allowed the U.S. government more 
time to publicize the requirement, according to DHS officials. Enforcement 
began in March 2010. According to most of the officials we interviewed 
from 17 airlines in the six VWP countries we visited, the phased-in 



'Some of the travel officials said, however, that initial efforts to publicize ESTA were 
confusing and that U.S. government officials could not answer some of their questions. 
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compliance generally allowed passengers sufficient time to learn about the 
ESTA requirement and allowed most airlines sufficient time to update 
their systems to meet the requirement. ESTA officials said that the phased- 
in compliance also provided time to fix problems with the system before 
enforcing airline and passenger compliance. 

• DHS responsiveness to travel industry feedback. VWP travel industry 
officials said that DHS officials' efforts to adapt ESTA in response to 
feedback have clarified the application process. Since initial 
implementation of ESTA in 2008, DHS has issued updates to the system on 
21 occasions. According to DHS officials, many of these changes 
addressed parts of the application that were unclear to applicants. For 
example, DHS learned from some travel industry officials that many 
applicants did not know how to answer a question on the application 
about whether they had committed a crime of moral turpitude because 
they did not know the definition of "moral turpitude." In September 2010, 
DHS released an updated ESTA application that included a definition of 
the term directly under the question. Further, updates have made the 
ESTA application available in 22 languages instead of only English. DHS 
also made it possible for denied applicants to reapply and be approved if 
they mistakenly answered "yes" to select eligibility questions. Although 
travel industry officials we met with in six VWP countries said there are 
still ways ESTA should be improved, they said that DHS's responsiveness 
in amending the ESTA application had made the system more user 
friendly. 

• Shorter reported passenger processing times. According to a study 
commissioned by DHS and conducted at three U.S. ports of entry, ESTA 
has reduced the average time DHS takes to process a VWP passenger 
before deciding whether to admit them into the United States by a range of 
between 17.8 and 54 percent. 16 The study attributed this time savings to 
factors such as the reduction in number of documents DHS officers 
needed to handle and evaluate and the reduction in data entry needed at 
the port of entry. 

Although DHS took steps to minimize the burden imposed by ESTA 
implementation, almost all government and travel industry officials we 



GAO did not independently verify the results or methodology of this study. The study was 
completed by RTR Technologies, LLC, at three high-volume ports of entry. According to 
the study, RTR chose a sample size to ensure results at a 95 percent confidence level and 
compared the baseline data collected in 2008 with a control group in 2010 to ensure that 
the results were not attributable to factors other than ESTA. 
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met in six VWP countries expressed dissatisfaction over the Travel 
Promotion Act of 2009 (TPA) 17 fee collected as part of the ESTA 
application. In September 2010, the U.S. government began to charge 
ESTA applicants a $14 fee when they applied for ESTA approval, including 
$10 for the creation of a corporation to promote travel to the United States 
and $4 to fund ESTA operations. 18 According to many of the VWP country 
government and travel industry officials with whom we met, the TPA fee is 
unfair because it burdens those traveling to the United States with an 
added fee to encourage others to travel to the United States. Some of the 
officials pointed out that it was unrelated to VWP travel and that it runs 
counter to the program objective of simplifying travel for VWP 
participants. DHS officials said that many government and travel industry 
officials from VWP countries view the fee as a step away from visa-free 
travel and consider ESTA with the fee "visa-lite." By comparison, a 
nonimmigrant visitor visa costs over $100 but is generally valid for five 
times as long as ESTA approval. Several foreign officials said they 
expected that the fee amount would continue to rise over time. DHS 
officials stated that they cannot control the TPA portion of the ESTA fee 
because it was mandated by law. 19 

In addition, some airline officials expressed concern that the ESTA 
requirement was one of many requirements imposed by DHS that required 
the carriers to bear the cost of system updates. DHS officials said that the 
ESTA requirement did impose a new cost to carriers, but that it was 
necessary to strengthen the security of the VWP. 



'Tub. L. No. 111-145, 124 Stat. 49, 56 (Mar. 4, 2010). 

18 The law requires that the fee be the sum of $10 per travel authorization and an amount 
that will at least ensure recovery of the full cost of providing and administering the system. 
DHS may only collect the $10 fee until September 30, 2015. See 8 U.S.C. § 1187(h)(3)(B). 
According to DHS officials, the $4 fee is paid for each application submitted and the $10 
TPA fee is only paid if the ESTA application is approved. The TPA fee is not for DHS use. 

19 DHS received an appropriation of $36 million for ESTA in fiscal year 2008. It carried over 
$11 million of that into fiscal year 2009. DHS officials said that because no funding was 
appropriated to the ESTA office in fiscal year 2010, DHS had to reallocate funds from other 
DHS components to cover ESTA operations. DHS completed a study to determine the fee 
amount that would cover its costs and, according to a DHS official, DHS policy allows for 
reevaluation of the fee amount as necessary. 
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According to DHS, air and sea carriers are required to verify that each 
passenger they board has ESTA approval before boarding them. Carriers' 
compliance with the requirement has increased since DHS made ESTA 
mandatory and has exceeded 99 percent in recent months. DHS data show 
the following: 

2008. In 2008, when VWP passenger and carrier compliance was 
voluntary, airlines and sea carriers verified ESTA approval for about 5.4 
percent of passengers boarded under the VWP. According to DHS officials, 
carriers needed time to update their systems to receive passengers' ESTA 
status, and DHS needed time to publicize the new travel requirement. 

• 2009. ESTA became mandatory in January 2009, and carriers verified 
ESTA approval for about 88 percent of passengers boarded under the VWP 
that year. 

• 2010. In March 2010, DHS began enforcing carrier compliance. In that 
year, carriers verified ESTA approval for almost 98 percent of VWP 
passengers. As of January 2011, DHS had imposed fines on VWP carriers 
for 5 of the passengers who had been allowed to board without ESTA 
approval. 20 



Carrier Compliance with 
ESTA Requirement 
Increased After DHS Made 
ESTA Mandatory, but DHS 
Has Not Fully Assessed 
Risks of Noncompliance . 



Figure 4 shows the percentage of VWP passengers boarded by carriers 
who had verified the passengers' ESTA approval. In addition, from 
September 2010 through January 2011, carrier compliance each month 
exceeded 99 percent. 



DHS began enforcing carrier compliance with ESTA requirements in March 2010, 
exercising the right to fine a carrier $3,300 for each passenger boarded under the VWP on a 
U.S. bound carrier without an approved ESTA application or to rescind the carrier's VWP 
signatory status for failure to comply with the ESTA requirement. 
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Figure 4: Percentage of VWP Passengers Boarded with Verified ESTA Approval, 2008-2010 



2008 



5.4% 




Verification voluntary 



2009 



2010 




2.2% 



87.7% 




Verification mandatory as of 
12 January 2009 




Compliance enforced as of 
20 March 2010 



DHS Has Not Fully Analyzed 
Risks Associated with ESTA 
Noncompliance 



VWP travelers boarded without verified ESTA approval 
| VWP travelers boarded with verified ESTA approval 
Source: GAO analysis of DHS data. 

Although carriers verified ESTA approval for almost 98 percent of VWP 
passengers before boarding them for VWP travel in 2010, DHS has not fully 
analyzed the potential risks posed by cases where carriers boarded 
passengers for VWP travel without verifying that they had ESTA approval. 
In 2010, about 2 percent — 364,086 VWP passengers — were boarded 
without verified ESTA approval. For most of these passengers — 363,438, 
or about 99.8 percent — no ESTA application had been recorded. The 
remainder without ESTA approval — 648, or about 0.2 percent — were 
passengers whose ESTA applications had been denied. 21 DHS officials told 
us that, although there is no official agency plan for monitoring and 
oversight of ESTA, the ESTA office is undertaking a review of each case of 
a carrier's boarding a VWP traveler without an approved ESTA application; 



Representatives of 17 airlines with whom we met told us that they did not track the 
number of passengers not permitted to board because of a denied VWP application or 
failure to apply through ESTA. However, the officials said that at least a few such 
passengers were denied permission to board each day. DHS officials said that they had no 
way of tracking the number of passengers that airlines refused to board due to lack of 
ESTA approval. 
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however, DHS has not established a target date for completing this review. 
In its review of these cases, DHS officials said they expect to determine 
why the carrier boarded the passengers, whether and why DHS admitted 
these individuals into the United States, and whether the airline or sea 
carrier should be fined for noncompliance. 

DHS tracks some data on passengers that travel under the VWP without 
verified ESTA approval but does not track other data that would help 
officials know the extent to which noncompliance poses a risk to the 
program. For example, although DHS officials said that about 180 VWP 
travelers who arrive at a U.S. port of entry without ESTA approval are 
admitted to the United States each day, they have not tracked how many, 
if any, of those passengers had been denied by ESTA. 22 DHS also reported 
that 6,486 VWP passengers were refused entry into the United States at the 
port of entry in 2010, but that number includes VWP passengers for whom 
carriers had verified ESTA approval. Officials did not track how many of 
those had been boarded without verified ESTA approval. DHS also did not 
know how many passengers without verified ESTA approval were boarded 
with DHS approval after system outages precluded timely verification of 
ESTA approval. 

Without a completed analysis of noncompliance with ESTA requirements, 
DHS is unable to determine the level of risk that noncompliance poses to 
VWP security and to identify improvements needed to minimize 
noncompliance. In addition, without analysis of data on travelers who 
were admitted to the United States without a visa after being denied by 
ESTA, DHS cannot determine the extent to which ESTA is accurately 
identifying individuals who should be denied travel under the program. 



Only Half of VWP 
Countries Have 
Entered Into All 
Required Information- 
Sharing Agreements 



Although DHS and partners at State and Justice have made progress in 
negotiating information-sharing agreements with VWP countries, required 
by the 9/11 Act, only half of the countries have entered into all required 
agreements. In addition, many of the agreements entered into have not 
been implemented. The 9/11 Act does not establish an explicit deadline for 
compliance, but DHS with support from State and Justice has produced a 
completion schedule that requires agreements to be entered into by the 



DHS officials reported that CBP does not typically deny VWP travelers admission to the 
United States solely for lack of an approved ESTA. Most of those denied entry are deemed 
inadmissible for other reasons. 
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end of each country's current or next biennial review cycle, the last of 
which will be completed by June 2012. In coordination with State and 
Justice, DHS also outlined measures short of termination that may be 
applied to VWP countries not meeting their compliance date. 



The 9/11 Act specifies that each VWP country must enter into agreements 
with the United States to share information regarding whether citizens and 
nationals of that country traveling to the United States represent a threat 
to the security or welfare of the United States and to report lost or stolen 
passports. DHS, in consultation with other agencies, has determined that 
VWP countries can satisfy the requirement by entering into the following 
three bilateral agreements: 

• Homeland Security Presidential Directive 6 (HSPD-6), 

• Preventing and Combating Serious Crime (PCSC), and 

• Lost and Stolen Passports (LASP). 23 

According to DHS officials, countries joining the VWP after the 9/11 Act 
entered into force are required to enter into HSPD-6 and PCSC agreements 
with the United States as a condition of admission into the program. In 
addition, prior to joining the VWP, such countries are required to enter 
into agreements containing specific arrangements for information sharing 
on lost and stolen passports. As illustrated in table 3 below, DHS, State, 
and Justice have made some progress with VWP countries in entering into 
the agreements. 



DHS Requires VWP 
Countries to Enter Into 
Three Agreements 



For the HSPD-6 and PCSC agreements, DHS made the determination in consultation with 
State and Justice. For the LASP agreement, DHS made the determination in consultation 
with State alone. 
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Table 3: Status of Information-Sharing Agreements Required Since 2007 for VWP Countries as Reported by U.S. Government 
Agencies 



Agreement 


Number 
entered into 


Percentage 
entered into 


Number 
implemented 


Percentage 
implemented 


Type of information shared 


HSPD-6 


19 


53 


13 


36 


Known and suspected terrorists 


PCSC 


18 a 


50 








Perpetrators of serious crime 


LASP 


34 


94 


34 b 


94 


Lost and stolen passports 



Sources: DHS, Justice, and State. 

°As of January 201 1 , the following 1 8 countries have met the requirement to enter into PCSC 
agreements: Austria, the Czech Republic, Denmark, Estonia, Finland, Germany, Greece, Italy, Latvia, 
Lithuania, Hungary, Malta, the Netherlands, Portugal, Slovakia, South Korea, Spain, and the United 
Kingdom. According to DHS officials, pre-existing agreements with one of these countries fulfill PCSC 
information-sharing requirements and eliminate the need to enter into a separate PCSC agreement. 

"Although 2 VWP countries have not signed LASP agreements, according to Interpol officials, all 
VWP countries share LASP data. 

All VWP countries and the United States share some information with one 
another on some level, but the existence of a formal agreement improves 
information sharing, according to DHS officials. As opposed to informal 
case-by-case information sharing, formal agreements expand the pool of 
information to which the United States has systematic access. They can 
draw attention to and provide information on individuals of whom the 
United States would not otherwise be aware. According to officials, formal 
agreements generally expedite the sharing of information by laying out 
specific terms that can be easily referred to when requesting data. DHS 
officials observed that timely access to information is especially important 
for CBP officials at ports of entry. 

HSPD-6 Agreement HSPD-6 agreements establish a procedure between the United States and 

partner countries to share watchlist information about known or 
suspected terrorists. As of January 2011, 19 of the 36 VWP countries had 
signed HSPD-6 agreements, and 13 have begun sharing information 
according to the signed agreements. 24 (See table 3.) Justice's Terrorist 
Screening Center (TSC) and State have the primary responsibility to 
negotiate and conclude these information-sharing agreements. An 
interagency working group, co-led by TSC and State that also includes 
representatives from U.S. law enforcement, intelligence, and policy 



HSPD-6 agreements are not exclusive to VWP countries and can be signed with any 
countries with the approval of the interagency working group. As of January 2011, in 
addition to the 19 VWP countries, 3 non-VWP countries have signed HSPD-6 agreements. 
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communities, addresses issues with the exchange of information and 
coordinates efforts to enhance information exchange. While the 
agreements are based on a template that officials use as a starting point 
for negotiations, according to TSC officials, the terms of each HSPD-6 
agreement are unique, prescribing levels of information sharing that reflect 
the laws, political will, and domestic policies of each partner country. TSC 
officials said most HSPD-6 agreements are legally nonbinding. Officials 
said that this allows more flexibility in information-sharing procedures and 
simplifies negotiations with officials from partner countries. The TSC 
officials noted that the nonbinding nature of the agreements may allow 
some VWP countries to avoid bureaucratic and political hurdles. 

Noting that State and TSC continue to negotiate HSPD-6 agreements with 
VWP countries, officials cited concerns regarding privacy and data 
protection expressed by many VWP countries as reasons for the delayed 
progress. According to these officials, in some cases, domestic laws of 
VWP countries limit their ability to commit to sharing some information, 
thereby complicating and slowing the negotiation process. The terms of 
HSPD-6 agreements are also extremely sensitive, TSC officials noted, and 
therefore many HSPD-6 agreements are classified. Officials expressed 
concern that disclosure of the agreements themselves might either (1) 
cause countries that had already signed agreements to become less 
cooperative in sharing data on known or suspected terrorists and reduce 
the exchange of information or (2) cause countries in negotiation to 
become less willing to sign agreements or insist on terms prescribing less 
information sharing. 

The value and quality of information received through HSPD-6 agreements 
vary, and some partnerships are more useful than others, according to TSC 
officials. The officials stated that some partner countries were more 
willing than others to share data on known or suspected terrorists. For 
example, according to TSC officials, some countries do not share data on 
individuals suspected of terrorist activity but only on those already 
convicted. In other cases, TSC officials stated that some partner countries 
did not have the technical capacity to provide all information typically 
obtained through HSPD-6 agreements. For example, terrorist watchlist 
data include at least the name and date of birth of the suspect and may 
also include biometric information such as fingerprints or photographs. 
According to DHS officials, some member countries do not have the legal 
or technical ability to store such information. 

TSC has evidence that information is being shared as a result of HSPD-6 
agreements. They provided the number of encounters with known or 
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suspected terrorists generated through sharing watchlist information with 
foreign governments. 25 TSC officials noted that they viewed these data as 
one measure of the relevance of the program, but not as comprehensive 
performance indicators. Although TSC records the number of encounters, 
HSPD-6 agreements do not contain terms requiring partner countries to 
reveal the results of these encounters, and there is no case management 
system to track and close them out, according to TSC officials. 

PCSC Agreement The PCSC agreements establish the framework for law enforcement 

cooperation by providing each party automated access to the other's 
criminal databases that contain biographical, biometric, and criminal 
history data. (See table 3.) As of January 2011, 18 of the 36 VWP countries 
had met the PCSC information-sharing agreement requirement, but the 
networking modifications and system upgrades required to enable this 
information sharing to take place have not been completed for any VWP 
countries. The language of the PCSC agreements varies slightly because, 
according to agency officials, partner countries have different legal 
definitions of what constitutes a serious crime or felony, as well as varying 
demands regarding data protection provisions. 

Achieving greater progress negotiating PCSC agreements has been 
difficult, according to DHS officials, because the agreements require 
lengthy and intensive face-to-face discussions with foreign governments. 
Justice and DHS, with assistance from State, negotiate the agreements 
with officials from partner countries that can include representatives from 
their law enforcement and justice ministries, as well as their diplomatic 
corps. Further, sharing sensitive personal information with the United 
States is publicly unpopular in many VWP countries, even if the countries' 
law enforcement agencies have no reluctance to share information. 
Officials in some VWP countries told us that efforts to overcome political 
barriers have caused further delays. 

Though officials expect to complete networking modifications necessary 
to allow queries of Spain's and Germany's criminal databases in 2011, the 
process is a legally and technically complex one that has not yet been 
completed for any of the VWP countries. According to officials, DHS is 
frequently not in a position to influence the speed of PCSC implementation 



°TSC defines an encounter as an authorized official contact with a person, such as when 
an individual attempts to board an aircraft or apply for a passport or visa, enter a country 
at a port of entry, etc. 
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for a number of reasons. For example, according to DHS officials, some 
VWP countries require parliamentary ratification before implementation 
can begin. Also U.S. and partner country officials must develop a common 
information technology architecture to allow queries between databases. 

LASP Agreement m a 2006 GAO report, 26 we found that not all VWP countries were 

consistently reporting data on lost and stolen passports. We recommended 
that DHS develop clear standard operating procedures for such reporting, 
including a definition of timely reporting. As of January 2011, all VWP 
countries were sharing lost and stolen passport information with the 
United States, and 34 of the 36 VWP countries had entered into LASP 
agreements. 27 (See table 3.) 

The 9/11 Act requires VWP countries to enter into an agreement with the 
United States to report, or make available to the United States through 
Interpol or other means as designated by the Secretary of Homeland 
Security information about the theft or loss of passports. According to 
DHS officials, other international mandates have helped the United States 
to obtain LASP information. Since 2005, all European Union countries 
have been mandated to send data on lost and stolen passports to Interpol 
for its Stolen and Lost Travel Documents database. In addition, Australia 
and New Zealand have agreements to share lost and stolen passport 
information through the Regional Movement Alert System. According to 
officials, in fiscal year 2004, more than 700 fraudulent passports from VWP 
countries were intercepted at U.S. ports of entry; however, by fiscal year 
2010, this number had decreased to 64. DHS officials attributed the 
decrease in the use of fraudulent passports in part to better LASP 
reporting to Interpol. More complete data has allowed DHS to identify 
more individuals attempting VWP travel with a passport that has been 
reported lost or stolen before they begin travel. 



*See GAO-06-854. 

2 According to DHS, LASP agreements took the form of either Memorandums of 
Understanding (MOU) or diplomatic notes, declaring the countries' intent to comply with 
the information-sharing requirement. Countries that joined the VWP between 2008 and 
2010 each signed an MOU prior to their designation. These MOUs contain language on the 
exchange of LASP data, and therefore these countries were not also required to exchange 
diplomatic notes. 
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DHS Established a 
Compliance Schedule for 
Entering Into Information- 
Sharing Agreements 



Although the 9/11 Act does not establish an explicit deadline, DHS, with 
the support of partners at State and Justice, has produced a compliance 
schedule that requires agreements to be entered into by the end of each 
country's current or next biennial review cycle, the last of which will be 
completed by June 2012. In March 2010, State sent a cable to posts in all 
VWP countries that instructed the appropriate posts to communicate the 
particular compliance date to the government of each noncompliant VWP 
country. However, DHS officials expressed concern that some VWP 
countries may not have entered into all agreements by the specified 
compliance dates. 



DHS Has Outlined 
Measures to Encourage 
VWP Countries to Enter 
Into Information-Sharing 
Agreements 



According to DHS officials, termination from the VWP is one potential 
consequence for VWP countries that do not enter into information-sharing 
agreements. However, U.S. officials described termination as undesirable, 
saying that it would significantly impact diplomatic relations and would 
weaken any informal exchange of information. Further, termination would 
require all citizens from the country to obtain visas before traveling to the 
United States. According to officials, particularly in the larger VWP 
countries, this step would overwhelm consular offices and discourage 
travel to the United States, thereby damaging trade and tourism. U.S. 
embassy officials in France told us that when the United States required 
only a small portion of the French traveling population — those without 
machine-readable passports — to obtain visas, U.S. embassy officials 
logged many overtime hours, while long lines of applicants extended into 
the embassy courtyard. 

DHS helped write a classified strategy document that outlines a 
contingency plan listing possible measures short of termination from the 
VWP that may be taken if a VWP country does not meet its specified 
compliance date for entering into information-sharing agreements. 28 The 
strategy document provides steps that would need to be taken prior to 
selecting and implementing one of these measures. According to officials, 
DHS plans to decide which measures to apply on a case-by-case basis. 



DHS drafted this classified document in coordination with State and Justice. It was 
submitted to the National Security Staff in January 2010 and subsequently approved. 
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DHS Has Not 
Consistently 
Completed Timely 
Biennial Reports 



DHS conducts reviews to determine whether issues of security, law 
enforcement, or immigration affect VWP country participation in the 
program; however, the agency has not completed half of the mandated 
biennial reports resulting from these reviews in a timely manner. In 2002, 
Congress mandated that, at least once every 2 years, DHS evaluate the 
effect of each country's continued participation in the program on the 
security, law enforcement, and immigration interests of the United States. 
The mandate also directed DHS to determine based on the evaluation 
whether each VWP country's designation should continue or be terminated 
and to submit a written report on that determination to select 
congressional committees. 29 



To fulfill this requirement, DHS conducts reviews of VWP countries that 
examine and document, among other things, counterterrorism and law 
enforcement capabilities, border control and immigration programs and 
policies, and security procedures. To document its findings, DHS 
composes a report on each VWP country reviewed and a brief summary of 
the report to submit to congressional committees. In conjunction with 
DHS's reviews, the Director of National Intelligence (DNI) produces 
intelligence assessments that DHS reviews prior to finalizing its VWP 
country biennial reports. 30 According to VWP officials, they visited 12 
program countries in fiscal year 2009 and 10 countries in fiscal year 2010 
to gather the data needed to complete these reports. As of February 2011, 
the Visa Waiver Program Office had completed 3 country visits and 
anticipated conducting 10 more for fiscal year 2011. If issues of concern 
are identified during the VWP country review process, DHS drafts an 
engagement strategy documenting the issues of concern and suggesting 
recommendations for addressing the issues. According to VWP officials, 
they also regularly monitor VWP country efforts to stay informed about 
any emerging issues that may affect the countries' VWP status. 



In 2006, we found that DHS had not completed the required biennial 
reviews in a timely fashion, and we recommended that DHS establish 
protocols including deadlines for biennial report completion. DHS 



See the Enhanced Border Security and Visa Entry Reform Act of 2002. Prior to this 
change, DHS was required to report at least once every 5 years. 

30 The 9/11 Act requires the DNI to conduct an independent intelligence assessment of 
countries prior to their admission to the VWP and for all VWP countries in conjunction with 
the VWP biennial reports and to submit them to, among others, the Secretary of Homeland 
Security. 
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established protocols in 2007 that include timely completion of biennial 
reports as a goal. Our current review shows that DHS has not completed 
the latest biennial reports for 50 percent, or 18 of the 36 VWP countries in 
a timely manner. Also, over half of those reports are more than 1 year 
overdue. In the case of two countries, DHS was unable to demonstrate that 
they had completed reports in over 4 years. 31 Further, according to the 
evidence supplied by DHS, of the 17 reports completed since the beginning 
of 2009, over 25 percent were transmitted to Congress 3 or more months 
after report completion, and 2 of those after more than 6 months. DHS 
cited a number of reasons for the reporting delays, including a lack of 
resources needed to complete timely reports. In addition, DHS officials 
said that they sometimes intentionally delayed report completion for two 
reasons: (1) because they frequently did not receive DNI intelligence 
assessments in a timely manner and needed to review these before 
completing VWP country biennial reports or (2) in order to incorporate 
anticipated developments in the status of information-sharing agreement 
negotiations with a VWP country. Further, DHS officials cited lengthy 
internal review as the primary reason for delays in submitting the formal 
summary reports to Congress. Without timely reports, it is not clear to 
Congress whether vulnerabilities exist that jeopardize continued 
participation in the VWP. 



The VWP facilitates travel for nationals from qualifying countries, 
removing the requirement that they apply in-person at a U.S. embassy for a 
nonimmigrant visa for business or pleasure travel of 90 days or less. In an 
attempt to facilitate visa-free travel without sacrificing travel security, 
Congress has mandated security measures such as ESTA, information- 
sharing requirements, and VWP country biennial reviews. While ESTA has 
added a fee and a new pretravel requirement that place additional burdens 
on the VWP traveler, it has reduced the burden on VWP travelers in several 
other ways. DHS does not fully know the extent to which ESTA has 
mitigated VWP risks, however, because its review of cases of passengers 
being permitted to travel without verified ESTA approval is not yet 
complete. Although the percentage of VWP travelers without verified 
ESTA approval is very small, DHS oversight of noncompliant travelers may 



In our review of DHS biennial reports, we identified inconsistencies in DHS 
recordkeeping. For example, as evidence of all completed biennial reports, DHS provided 
access to an internal DHS Web site that contained links to many, but not all completed 
reports. Further, DHS was unable to provide documentation of two reports that they said 
had been completed. 



Conclusions 
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reduce the risk that an individual that poses a security risk to the United 
States could board a plane or ship traveling to the United States. Even if 
DHS has authority to deny individuals entry to the United States in such 
cases, ESTA was designed to screen such individuals before they embark 
on travel to the United States. Moreover, with only half of the countries 
participating in the VWP in full compliance with the requirement to enter 
into information-sharing agreements with the United States, DHS may not 
have sufficient information to deny participation in the VWP to individuals 
who pose a security risk to the United States. In addition, the 
congressional mandate requiring VWP country biennial reports provides 
important information to Congress on security measures in place in VWP 
countries but also on potential vulnerabilities that could affect the 
countries' future participation in the program. Because DHS has not 
consistently submitted the reports in a timely manner since the legal 
requirement was imposed in 2002, Congress does not have the assurance 
that DHS efforts to require program countries to minimize vulnerabilities 
and its recommendations for continued status in the VWP are based on up- 
to-date assessments. 



Recommendations for ^° ensure * na ^ ^^S can identify an d mitigate potential security risks 

associated with the VWP, we recommend that the Secretary of Homeland 
Executive Action Security take the following two actions: 

• establish time frames for the regular review and documentation of cases of 
VWP passengers traveling to a U.S. port of entry without verified ESTA 
approval, and 

• take steps to address delays in the biennial country review process so that 
the mandated country reports can be completed on time. 



Agency Comments 
and Our Evaluation 



DHS provided written comments on a draft of this report. These comments 
are reprinted in appendix III. DHS, State, and Justice provided technical 
comments that we have incorporated into this report, as appropriate. In 
commenting on the draft, DHS stated that it concurred with GAO's 
recommendations and expects to be able to implement them. DHS 
provided additional information on its efforts to ensure that VWP 
countries remain compliant with program requirements and to monitor 
and assess issues that may pose a risk to U.S. interests. DHS also provided 
information on actions it is taking to resolve the issues identified in the 
audit. For example, DHS stated it will have established procedures by the 
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end of May 2011 to perform quarterly reviews of a representative sample 
of VWP passengers who do not comply with the ESTA requirement. 



As agreed with your offices, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies of this report to the 
appropriate congressional committees, the Secretary of Homeland 
Security, the Secretary of State, the Attorney General, and other interested 
parties. The report also will be available on the GAO Web site at no charge 
at http://www.gao.gov. 

If you or your staff members have any questions about this report, please 
contact me at (202) 512-4268 or fordj@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on the 
last page of this report. Key contributors are listed in appendix IV. 




Jess T. Ford 

Director, International Affairs and Trade 
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Appendix I: Scope and Methodology 



To assess the implementation of the Electronic System for Travel 
Authorization (ESTA), we reviewed relevant documentation, including 
2006 and 2008 GAO reports evaluating the Visa Waiver Program (VWP) and 
statistics on program applicants and travelers. Between June and 
September 2010, we interviewed consular, public diplomacy, and law 
enforcement officials at U.S. embassies in six VWP countries: France, 
Ireland, Japan, South Korea, Spain, and the United Kingdom. We also 
interviewed political and commercial officers at embassies in five of these 
countries. While the results of our site visits are not generalizable, they 
provided perspectives on VWP and ESTA implementation. We met with 
travel industry officials, including airline representatives, and foreign 
government officials in the six countries we visited to discuss ESTA 
implementation. We selected the countries we visited so that we could 
interview officials from VWP countries in diverse geographic regions that 
varied in terms of information-sharing signature status, number of 
travelers to the United States, and the existence in-country of potential 
program security risks. We met with officials from the Department of 
Homeland Security (DHS) in Washington, D.C. We used data provided by 
DHS from the ESTA database to assess the usage of the program and 
airline compliance with the ESTA requirements and determined that the 
data was sufficiently reliable for our purposes. 

To evaluate the status of information sharing, we analyzed data regarding 
which countries had signed the agreements and interviewed DHS, 
Department of State (State), and Department of Justice (Justice) officials 
in Washington, D.C, and International Criminal Police Organization 
(Interpol) officials in Lyon, France. We reviewed the Implementing 
Recommendations of the 9/11 Commission Act of 2007, which contained 
the information-sharing requirement. We received and reviewed copies of 
many Preventing and Combating Serious Crime and Lost and Stolen 
Passport agreements. While conducting our fieldwork, we confirmed the 
status of the agreements in each of the countries we visited. We 
determined that the data on the status of information sharing were 
sufficiently reliable for our purposes. However, we were unable to view 
the signed Homeland Security Presidential Directive 6 agreements, 
because Justice's Terrorist Screening Center declined to provide us 
requested access to the agreements. We also met with foreign government 
officials from agencies involved with VWP information-sharing agreement 
negotiations in the six countries we visited to discuss their views 
regarding VWP information-sharing negotiations with U.S. officials. In 
addition, with Interpol officials in France, we discussed the status of the 
sharing of information on lost and stolen passports. Interpol officials were 
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unable to provide country-specific statistics regarding sharing of lost and 
stolen passport information due to its data privacy policy. 

To assess DHS efforts to complete timely biennial reviews of each VWP 
country, we reviewed DHS documents, as well as the links to completed 
reviews on the DHS intranet Web site to determine whether the reviews 
were completed in a timely manner. We also reviewed a 2006 GAO report 
that recommended improvements to the timeliness of DHS's biennial 
reporting process. 

We conducted this performance audit from January 2010 to May 2011, in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 
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Appendix II: How to Apply for ESTA 
Approval 



The official ESTA application can be completed online at 
https://esta.cbp.dhs.gov/esta/. (See fig 5.) DHS officials told us they 
actively publicize the official Web site, because many unofficial Web sites 
exist that charge an additional fee to fill out an application for an 
individual. They said the unofficial Web sites are not fraudulent if they do 
not use the official DHS or ESTA logos and provide the service they 
promise. 
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Appendix II: How to Apply for ESTA Approval 



Figure 5: The ESTA Application Welcome Page 
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Appendix III: Comments from the 
Department of Homeland Security 



U.S. Department of Homeland Security 
W ashington, DC 20528 

Homeland 
Security 



April 25, 201 1 

Jess T. Ford 

Director, International Affairs and Trade 
U.S. Government Accountability Office 
441 G Street, N.W. 
Washington, D.C. 20548 



Re: GAO-1 1-335, Visa Waiver Program: DHS Has Implemented Electronic System for 
Travel Authorization but Further Steps Needed to Address Potential Program Risks 



Dear Mr. Ford: 
Introduction: 

The Department of Homeland Security (DHS) appreciates the opportunity to review and provide 
comments on draft report number GAO-1 1-335 by the Government Accountability Office 
(GAO) titled "Visa Waiver Program: DHS Has Implemented Electronic System for Travel 
Authorization but Further Steps Needed to Address Potential Program Risks." The Department 
is actively resolving the issues identified in the audit. 

Context: 

The draft report is broadly supportive of the Department's efforts to date to enhance the security 
requirements of the U.S. Visa Waiver Program (VWP). It recognizes that DHS has implemented 
the Electronic System for Travel Authorization (ESTA) to conduct pre-travel screening for VWP 
travelers, and that the Department has minimized the burden of this requirement on VWP 
travelers and carriers. The draft report also concludes that DHS and the Departments of State 
and Justice have made progress in completing information sharing agreements with VWP 
countries, as required by the Implementing Recommendations of the 9/11 Commission Act of 
2007, Pub. L. No. 1 10-53 (9/1 1 Act). Moreover, the two report recommendations are consistent 
with the Department's current approach, and we expect to be able to implement them. 

Nonetheless, the Department finds that the report does not fully take into account important 
initiatives DHS undertakes outside of our continuing eligibility reviews of VWP countries to 
ensure that these countries remain compliant with the program's requirements and to monitor 
and assess issues that may pose a risk to U.S. interests. 
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of Homeland Security 



I am confident that the steps DHS and its interagency partners have taken to implement the 
security-related provisions of the 9/1 1 Act and other VWP-related legislation continue to reduce 
program risks. In addition, the Department regularly monitors VWP countries, regardless of 
where they are in the eligibility review process. This also reduces program risks. 

The following describes more fully the Department's response to issues raised by GAO's report: 

1. GAO States: 

DHS has implemented ESTA to meet the 9/1 1 Act requirement intended to enhance program 
security and has taken steps to minimize the burden on travelers to the United States added by 
the new requirement, but has not fully analyzed the risks of carrier and passenger 
noncompliance with the requirement... DHS does not have a target completion date for a review 
to identify potential security risks associated with the small percentage of cases of traveler and 
carrier noncompliance with the ESTA requirement... Without a completed analysis of 
noncompliance with ESTA requirements, DHS is unable to determine the level of risk that 
noncompliance poses to VWP security and to identify improvements needed to minimize 
noncompliance. 

DHS has been reviewing and evaluating ESTA non-compliance since the system's inception. By 
the end of May 201 1, DHS will have established procedures to review quarterly a representative 
sample of non-compliant passengers to evaluate, identify, and mitigate potential security risks 
associated with the ESTA program. 

2. GAO States: 

DHS conducts reviews to determine whether issues of security, law enforcement, or immigration 
affect VWP country participation in the program; however, the agency has not completed half of 
the mandated biennial reports resulting from these reviews in a timely manner. In 2002, 
Congress mandated that, at least once every two years, DHS evaluate the effect of each 
country 's participation in the program on the law enforcement, immigration and security 
interests of the United States. ..In conjunction with DHS's reviews, the Director of National 
Intelligence (DNI) produces intelligence assessments, that DHS reviews prior to finalizing the 
VWP reports... 

As noted by GAO, DHS has protocols in place that are intended to meet the goal of completing 
all VWP continuing eligibility reviews in the statutorily prescribed period. DHS has made 
significant improvements since the establishment of these protocols, but the Department does 
acknowledge that the reports to Congress associated with VWP countries' continuing eligibility 
reviews are still not always finalized within this period. The Department discussed with GAO 
several impediments to completing all continuing eligibility reviews and reports within the 2- 
year period, which are addressed in more detail below. 



2 



Page 35 



GAO-11-335 Visa Waiver Program 



Appendix III: Comments from the Department 
of Homeland Security 



3. GAO States: 

DHS cited a number of reasons for the reporting delays, including a lack of resources. In 
addition, DHS officials said that they sometimes intentionally delayed report completion for two 
reasons: (1) Because they frequently did not receive DNI intelligence assessments in a timely 
manner and needed to review these before completing VWP country biennial reports; or (2) In 
order to incorporate anticipated developments in the status of information sharing agreement 
negotiations with a VWP country. 

DHS informed GAO that the process of receiving DNI's independent intelligence assessments — 
which are drafted by the DHS Office of Intelligence and Analysis (I&A) on behalf of DNI and 
by law are to be completed in conjunction with the continuing eligibility reviews — caused DHS 
to postpone finalizing a number of VWP reviews and reports in fiscal years 2009, 2010, and 
201 1. As noted by GAO, in several instances, the Department chose to postpone finalizing 
reviews and reports beyond the 2-year time period so that up-to-date information on VWP 
countries' compliance with the 9/1 1 Act information sharing requirements could be documented. 
Given congressional interest in VWP countries' compliance with the 9/1 1 Act, DHS felt it 
necessary to provide current information on this important issue. 

Over the past year, the DHS Visa Waiver Program Office (VWPO) has worked with DHS I&A 
to address the timeliness of the intelligence assessments. Since 2008, DHS I&A has drafted 
independent intelligence assessments on each VWP country, as required by law. These 
assessments have established an analytical base line on a range of security issues. Now that an 
analytical baseline has been established, a new format for the intelligence assessment has been 
adopted that focuses on key security issues that may have shifted since the previous assessment. 
With the new format, DNI assessments are expected to be finalized more expeditiously. 
Additionally, DHS VWPO is considering process changes to address GAO concerns with the 
timeliness of continuing eligibility VWP reports. 

4. GAO States: 

According to VWP officials, they also regularly monitor VWP country efforts to stay informed 
about emerging issues that may affect the countries ' VWP status. 

DHS uses both the statutorily required eligibility reviews and a continuous monitoring process to 
ensure that VWP countries remain compliant with the program's requirements and to monitor 
and assess issues that may pose a risk to U.S. interests. For example, on a daily basis DHS 
VWPO monitors and assesses available information to ensure awareness of changing conditions 
in VWP countries so as to verify that these countries' participation in the VWP do not pose a risk 
to U.S. security and law enforcement interests (including immigration enforcement interests). 
VWPO has established points of contact at U.S. Embassies and Consulates with law 
enforcement, security, and consular officials in the 36 participating VWP countries as well as 
with the Departments of State and Justice and the Intelligence Community. This network of 
contacts allows for continuous and substantive information exchange between VWPO and 
diplomatic posts, as well as VWPO and its Washington-based partners. 
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During the GAO audit, DHS discussed its regular monitoring process for VWP countries in 
detail and provided specific examples where the Department detected issues of concern outside 
of countries' formal continuing eligibility reviews. Through engagement with its contacts, DHS 
worked with the VWP countries to remedy issues of concern before they threatened the 
countries' VWP statuses and/or U.S. interests. 

S. GAO States: 

Without timely reports, it is not clear to Congress whether vulnerabilities exist that jeopardize 
continued participation in the VWP... Because DHS has not consistently submitted the reports in 
a timely manner since the legal requirement was imposed in 2002, Congress does not have the 
assurance that DHS efforts to require program countries to minimize vulnerabilities and its 
recommendations for continued status in the VWP are based on up-to-date assessments. 

DHS uses both the statutorily required eligibility reviews and a continuous monitoring process to 
ensure that VWP countries remain compliant with the program's requirements and to monitor 
and assess issues that may pose a risk to U.S. interests. The Department recognizes that timely 
reports provide Congress with information on a country's VWP status. Therefore, DHS VWPO 
is considering process changes to address GAO concerns with the timeliness of continuing 
eligibility VWP reports. However, DHS informed GAO that if a significant issue and/or 
vulnerability were detected during or outside of a continuing eligibility review, DHS, in 
consultation with its interagency partners, would take the appropriate steps to notify Congress 
expeditiously. 

Recommendations: 

Recommendation #1: Establish timeframes for the regular review and documentation of 
cases of VWP passengers traveling to a U.S. port of entry without verified ESTA approval. 

DHS concurs with the recommendation. DHS has been reviewing and evaluating ESTA non- 
compliance since the system's inception. By the end of May 201 1, DHS will have established 
procedures to review quarterly a representative sample of non-compliant passengers to evaluate, 
identify, and mitigate potential security risks associated with the ESTA program. 

Recommendation #2: Take steps to address delays in the biennial country review process so 
that the mandated country reports can be completed on time. 

DHS concurs with the recommendation. DHS VWPO is considering process changes to address 
GAO concerns with the timeliness of continuing eligibility VWP reports. Additionally, over the 
past year, DHS VWPO has worked with DHS I&A to address the timeliness of the intelligence 
assessments. Since 2008, DHS I&A has drafted independent intelligence assessments on each 
VWP country, as required by law. These assessments have established an analytical baseline on 
a range of security issues. Now that an analytical baseline has been established, a new format for 
the intelligence assessment has been adopted that focuses on key security issues that may have 
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shifted since the previous assessment. With the new format, DNI assessments are expected to be 
finalized more expeditiously. 

Conclusion: 

In summary, the Department concurs with the recommendations of the draft report. Once again, 
thank you for the opportunity to comment on the draft report. The Department looks forward to 
working with you on future Homeland Security engagements. 



Sincerely, 




Director 

Departmental GAO/OIG Liaison Office 
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